@bongos/core 1.19.999 → 1.19.1001

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.999",
+  "version": "1.19.1001",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.999",
+      "version": "1.19.1001",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.999",
+  "version": "1.19.1001",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/init.js

@@ -93,7 +93,12 @@ const KNOWN_MODULES = ['game', 'art-pipeline', 'discord', 'dev-box'];
 // more than the server does is worse than no list, because the refusal arrives a step
 // later with no useful message. Dropping it means `--shape co-tenant` fails here, naming
 // the shapes that work.
-const HOSTING_SHAPES = ['byo-host', 'dedicated', 'standalone'];
+//
+// 'dedicated' left for the same reason, one step further on: ADR 0327 decision 4 deleted
+// the shape outright, so it is not merely refused but unstorable (migration
+// provisioning_027 folded its value into 'cloud-host'). 'standalone' was renamed to
+// 'cloud-host' by the same migration. Both were requestable from here until task 1004182.
+const HOSTING_SHAPES = ['byo-host', 'cloud-host'];
 
 // The Cloud Bongos core npm package an instance pins as a dependency (ADR 0108).
 // `bongos init --adopt` LAYERS this onto an existing repo's package.json; `bongos
@@ -459,11 +464,14 @@ async function interview({ adopt = false } = {}) {
       // be a second copy of it, in a file no designer renaming the product would
       // think to open. A CLI prompt naming the stored value it is about to write is
       // the right register anyway: this asks for a column value, not for a purchase.
-      const shape = (await ask(rl, '  Hosting shape? (byo-host = you run it on your own host / standalone = its own repo + pinned @bongos/core on the platform\'s box / dedicated = the same on its own droplet, priced by tier)', 'byo-host')).toLowerCase();
+      const shape = (await ask(rl, '  Hosting shape? (byo-host = you run it on your own host / cloud-host = its own repo + pinned @bongos/core, stood up for you)', 'byo-host')).toLowerCase();
       const domain = await ask(rl, '  Domain you own — bring-your-own (blank = the platform assigns <slug>.<its apex> when configured)?');
       const targetRef = await ask(rl, '  Target credential ref? (which control-plane creds the runner should use; optional)');
-      let tier = '';
-      if (shape === 'dedicated') tier = await ask(rl, '  Droplet tier? (e.g. s-1vcpu-2gb; optional)');
+      // No tier question any more. It existed only for 'dedicated', which ADR 0327
+      // decision 4 deleted: on the owner's own platform account a bigger plan is a
+      // setting they choose, not a hosting shape we model. `tier` stays in the spec
+      // shape below because a previously-written spec may still carry one.
+      const tier = '';
       provisioning = {
         shape: HOSTING_SHAPES.includes(shape) ? shape : 'byo-host',
         domain: domain || undefined,

package/scripts/gds/onboard.js

@@ -54,7 +54,7 @@ function buildInitSpec(a = {}) {
     version: { id: a.versionId || 'V1', name: a.versionName || `${a.versionId || 'V1'} — Prove the loop`, done_when: a.doneWhen || 'The loop is proven end-to-end.' },
   };
   if (a.domain) spec.domains = { publicOrigin: `https://${a.domain}` };
-  if (a.domain || a.slug) spec.provisioning = { shape: 'standalone', domain: a.domain || null, slug: a.slug || null };
+  if (a.domain || a.slug) spec.provisioning = { shape: 'cloud-host', domain: a.domain || null, slug: a.slug || null };
   return spec;
 }
 

package/scripts/gds/provision-capacity.js

@@ -31,7 +31,12 @@ const MEMINFO_CMD = "grep -E '^Mem(Total|Available):' /proc/meminfo";
 async function capacityPreflight(inst, deps) {
   const { db, provisioning, exec, log, apply } = deps;
   const target = capacity.placementBox(inst.hosting_shape, { remoteHost: CONFIG.remoteHost });
-  if (!target) return { ok: true, skipped: 'dedicated' };
+  // No target box = no box of OURS to place this on, so there is no ceiling to ask about.
+  // Today that is 'byo-host' alone: the owner supplies the machine. It also covered
+  // 'dedicated' until ADR 0327 decision 4 removed that shape, which is why the skip reason
+  // is named for the QUESTION rather than for whichever shape happens to answer it — a
+  // reason label that names a shape goes stale the moment the shape does.
+  if (!target) return { ok: true, skipped: 'no-shared-box' };
   const boxExec = target.box === 'control-plane' ? (deps.controlExec || exec) : exec;
   let res = null;
   try { res = boxExec(MEMINFO_CMD, { allowFail: true }); } catch { res = null; }

package/scripts/gds/provision-config.js

@@ -102,9 +102,12 @@ const CONFIG = {
   // remote-exec splits the two boxes; all-local (no remoteHost) falls back to publicIp
   // since the control plane and the run box are then the same machine.
   controlPlaneIp: process.env.PROVISION_CONTROL_PLANE_IP || null,
-  // Parent dir for a STANDALONE instance's OWN repo checkout (hosting_shape='standalone',
-  // ADR 0108): each lives at <standaloneBase>/<slug> with @bongos/core installed as
-  // an npm dep. Distinct from co-tenant (which shares THIS control-plane checkout).
+  // Parent dir for the OWN repo checkout of an ADR 0108 standalone-topology instance —
+  // today that is the 'cloud-host' hosting shape. Each lives at <standaloneBase>/<slug>
+  // with @bongos/core installed as an npm dep. Distinct from co-tenant, which shares THIS
+  // control-plane checkout. The name stays "standalone" because it describes the TOPOLOGY,
+  // not the shape whose stored value task 1004182 renamed; PROVISION_STANDALONE_BASE is
+  // set on the live box and named in the /new-project skill, so renaming it breaks both.
   standaloneBase: process.env.PROVISION_STANDALONE_BASE || '/srv/cloudbongos',
   // ── Privilege escalation (task 2066, ADR 0128) ───────────────────────────
   // The intent runner runs as a NON-root user (provision-intent-runner.service:

package/scripts/gds/provision-core-upgrade.js

@@ -39,7 +39,7 @@ const { isValidSlug } = require('../../modules/provisioning/provisioning.js');
 // for one would be a request that is accepted and never lands. The route refuses the
 // same shape; this is the second gate, and it is the one that holds if a row's shape
 // changes between the request and the drain.
-const UPGRADE_SHAPES = Object.freeze(new Set(['co-tenant', 'standalone', 'control-plane']));
+const UPGRADE_SHAPES = Object.freeze(new Set(['co-tenant', 'cloud-host', 'control-plane']));
 
 // The strict three-number form a core version takes. Re-stated here rather than imported
 // from the web tier's core-upgrade.js: a module may not be required from scripts/ (ADR
@@ -152,7 +152,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
   const { db, provisioning, exec, log, apply, privileged } = deps;
   // A standalone's box IS the control plane's box, the same routing restartInstance and
   // settingsApplyInstance use; a co-tenant shares this checkout.
-  const boxExec = inst.hosting_shape === 'standalone' ? (deps.controlExec || exec) : exec;
+  const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || exec) : exec;
   const to = intent && intent.target_version;
   log(`core-upgrade ${inst.slug} → ${to || '(no target)'} (shape=${inst.hosting_shape}, status=${inst.status})`);
 
@@ -190,7 +190,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
   // ---- 2. is the target real, and permitted -----------------------------------------
   const channelMod = deps.updateChannel || require('./update-channel.js');
   const selfRoot = deps.selfInstanceRoot || selfInstanceRoot;
-  const instanceDir = inst.hosting_shape === 'standalone' ? standaloneRoot(inst) : selfRoot();
+  const instanceDir = inst.hosting_shape === 'cloud-host' ? standaloneRoot(inst) : selfRoot();
   const readInstalled = deps.readInstalledCoreVersion || require('./upgrade.js').readInstalledCoreVersion;
   const installed = readInstalled(instanceDir);
   // THE PLATFORM DEFAULT, NOT A PER-INSTANCE CHANNEL — and saying so beats implying
@@ -325,7 +325,7 @@ function resolveRunAs(inst, deps, { probe: allowProbe = true } = {}) {
   // probe on `exec` would then ask the co-hosting box whether an account exists while
   // the command it is deciding for runs on the control plane — a wrong answer that
   // looks like a right one.
-  const boxExec = inst.hosting_shape === 'standalone' ? (deps.controlExec || deps.exec) : deps.exec;
+  const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || deps.exec) : deps.exec;
   const r = boxExec(`id -u ${wanted}`, { allowFail: true });
   const failed = !r || r.softFailed === true || r.ok === false;
   if (!failed) return { runAs: wanted, fellBack: false };
@@ -371,7 +371,7 @@ function upgradeInvocation(inst, to, { privileged = false, dryRun = false, reque
   // just to node_modules/@bongos/core — and the door aimed at the package instead of
   // the project. So ask, rather than assume; in the legacy shape the answer is
   // REPO_ROOT and the command below is byte-identical to what it always was.
-  const instanceDir = inst.hosting_shape === 'standalone' ? standaloneRoot(inst) : selfRoot();
+  const instanceDir = inst.hosting_shape === 'cloud-host' ? standaloneRoot(inst) : selfRoot();
   // WHICH ACCOUNT, AND WHY IT IS RESOLVED RATHER THAN DERIVED (task 1004128).
   //
   // Task 1004119 wrote this as `control-plane ? APP_USER : instanceUser(inst)` and was
@@ -409,7 +409,7 @@ function upgradeInvocation(inst, to, { privileged = false, dryRun = false, reque
 // is the interesting answer, not an exception: pre-flight refusing is what this is for.
 function preflightUpgrade(inst, to, deps) {
   const { exec, privileged } = deps;
-  const boxExec = inst.hosting_shape === 'standalone' ? (deps.controlExec || exec) : exec;
+  const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || exec) : exec;
   // A distinct local name: `deps.selfInstanceRoot || selfInstanceRoot` with a const of
   // the same name would TDZ-shadow the import and crash every uninjected call.
   const selfRoot = deps.selfInstanceRoot || selfInstanceRoot;
@@ -718,10 +718,10 @@ async function preflightCoreUpgrade(inst, deps, intent) {
 async function snapshotCoreVersions(inst, deps) {
   const { db, exec, log } = deps;
   if (!UPGRADE_SHAPES.has(inst.hosting_shape) || inst.status !== 'active') return { ok: true, skipped: true };
-  const boxExec = inst.hosting_shape === 'standalone' ? (deps.controlExec || exec) : exec;
+  const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || exec) : exec;
   const channelMod = deps.updateChannel || require('./update-channel.js');
   const selfRoot = deps.selfInstanceRoot || selfInstanceRoot;
-  const instanceDir = inst.hosting_shape === 'standalone' ? standaloneRoot(inst) : selfRoot();
+  const instanceDir = inst.hosting_shape === 'cloud-host' ? standaloneRoot(inst) : selfRoot();
   try {
     const probe = boxExec(versionCmd(inst), { allowFail: true });
     const body = probe && !probe.softFailed ? (probe.stdout || '') : null;

package/scripts/gds/provision-disconnect.js

@@ -49,7 +49,7 @@ function eraseCommands(inst, { privileged = false } = {}) {
     `${sudo}find ${CONFIG.backupDir} -maxdepth 1 -type f -name '${dumpGlob(inst)}' -delete`,
     `${sudo}rm -rf ${path.posix.dirname(webEnvPath(inst))} ${instanceStateDir(inst)}`,
   ];
-  if (inst.hosting_shape === 'standalone') cmds.push(`${sudo}rm -rf ${standaloneRoot(inst)}`);
+  if (inst.hosting_shape === 'cloud-host') cmds.push(`${sudo}rm -rf ${standaloneRoot(inst)}`);
   cmds.push(`if id -u ${user} >/dev/null 2>&1; then ${sudo}userdel ${user}; fi`);
   return cmds;
 }
@@ -63,7 +63,7 @@ async function disconnectInstance(inst, deps) {
   await teardownInstance(inst, deps);
 
   if (inst.hosting_shape !== 'dedicated') {
-    const boxExec = inst.hosting_shape === 'standalone' ? (deps.controlExec || exec) : exec;
+    const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || exec) : exec;
     for (const cmd of eraseCommands(inst, { privileged })) {
       try { boxExec(cmd); }
       catch (e) { return { ok: false, error: `erase step failed (${cmd.split(' ').slice(0, 3).join(' ')}): ${(e && e.message) || e}` }; }

package/scripts/gds/provision-process.js

@@ -75,13 +75,13 @@ function supervisorConfPath(inst) {
 // cannot drift: a standalone runs out of its own pinned core, anything else out of this
 // checkout.
 function programCommand(inst) {
-  return inst.hosting_shape === 'standalone'
+  return inst.hosting_shape === 'cloud-host'
     ? `/usr/bin/node ${CORE_PKG_DIR}/src/platform-server.js`
     : '/usr/bin/node src/platform-server.js';
 }
 
 function supervisorProgram(inst, { etcBase = CONFIG.etcBase } = {}) {
-  const workDir = inst.hosting_shape === 'standalone' ? standaloneRoot(inst) : REPO_ROOT;
+  const workDir = inst.hosting_shape === 'cloud-host' ? standaloneRoot(inst) : REPO_ROOT;
   return `[program:${inst.slug}]
 ; Cloud Bongos instance — ${inst.slug} (provisioned by provision.js, ADR 0306)
 command=${programCommand(inst)}

package/scripts/gds/provision-repo-private.js

@@ -40,7 +40,7 @@ async function repoPrivateInstance(inst, deps) {
 
   // Only a standalone project has its own checkout to wire; any other shape reads from a
   // checkout this project does not own, so a key minted here would change nothing.
-  if (inst.hosting_shape !== 'standalone') {
+  if (inst.hosting_shape !== 'cloud-host') {
     return { ok: false, error: 'This project shares its code checkout with others, so its repository cannot be made private from here.' };
   }
   if (inst.status !== 'active') {

package/scripts/gds/provision-repo.js

@@ -79,8 +79,18 @@ function seedFirstVersionCmd(inst, { privileged = false } = {}) {
   return asPostgres(`psql -v ON_ERROR_STOP=1 -d ${dbName(inst)} -c '${sql}'`, privileged);
 }
 
-// ── STANDALONE shape (hosting_shape='standalone', ADR 0108, task 1978) ────────
-// A standalone instance runs from its OWN repo checkout (host content: config/,
+// ── The CLOUD-HOST shape (hosting_shape='cloud-host', ADR 0108, task 1978) ────
+//
+// TWO SENSES OF "STANDALONE", AND THIS FILE USES BOTH. The ADR 0108 sense is a repo
+// TOPOLOGY: an instance running from its own checkout with the core as an npm dependency,
+// as opposed to co-tenant's shared control-plane checkout. That is what `standaloneRoot`,
+// `standaloneBase` and `PROVISION_STANDALONE_BASE` name, and those keep their spelling —
+// `PROVISION_STANDALONE_BASE` in particular is a live environment variable on the control
+// plane and is documented in the /new-project skill. The other sense was the HOSTING SHAPE
+// once stored as 'standalone'; task 1004182 renamed that value to 'cloud-host'. Only the
+// stored value moved. Do not "finish the rename" by touching the topology names.
+//
+// A cloud-host instance runs from its OWN repo checkout (host content: config/,
 // migrations/instance/, the core PIN in package.json) with @bongos/core installed
 // as an npm DEPENDENCY — NOT the shared control-plane checkout the co-tenant shape uses.
 // It is the ADR 0108 DESTINATION model; these generators make provision.js drive the
@@ -883,7 +893,7 @@ function deployKeyPath(inst) { return path.posix.join(standaloneRoot(inst), '.gi
 async function ensurePrivateRepoAccess(inst, deps) {
   const { log, apply } = deps;
   const exec = deps.controlExec || deps.exec;
-  if (inst.hosting_shape !== 'standalone') return { skipped: 'shape' };
+  if (inst.hosting_shape !== 'cloud-host') return { skipped: 'shape' };
   const repo = parseTargetRef(inst.target_ref);
   if (!repo) return { skipped: 'no_repo' };
   // Dry-run stays OFFLINE like every other plan path here (the checkDnsTokenScope

package/scripts/gds/provision-teardown.js

@@ -24,7 +24,7 @@ async function teardownInstance(inst, deps) {
   // local (task 2074), so disable/remove its unit HERE — not on the remote co-hosting
   // box, where it was never installed (that would allowFail-noop and leave the real
   // control-plane unit running). Co-tenant + dedicated are unchanged.
-  const boxExec = inst.hosting_shape === 'standalone' ? controlExec : exec;
+  const boxExec = inst.hosting_shape === 'cloud-host' ? controlExec : exec;
   const sudoP = privileged ? 'sudo ' : '';   // systemctl / rm-under-/etc escalation (task 2066)
   log(`teardown ${inst.slug} (status=${inst.status})`);
   if (apply) await provisioning.setInstanceStatus(db, inst.id, 'tearing_down');
@@ -47,7 +47,7 @@ async function teardownInstance(inst, deps) {
   // files must NOT ride along — and a revoke skip must be LOUD: a torn-down project
   // silently keeping durable read access to the owner's private repo is the exact
   // shape a teardown exists to end. A missing token / API hiccup never blocks it.
-  if (inst.hosting_shape === 'standalone' && inst.target_ref) {
+  if (inst.hosting_shape === 'cloud-host' && inst.target_ref) {
     const repo = parseTargetRef(inst.target_ref);
     if (repo) {
       try {

package/scripts/gds/provision-units.js

@@ -16,7 +16,7 @@ const { CORE_PKG_DIR, appUser, dbName, instanceDbRole, instanceStateDir, instanc
 function serviceUnit(inst, { etcBase = CONFIG.etcBase } = {}) {
   const envFile = path.posix.join(etcBase, inst.slug, 'web.env');
   const user = instanceUser(inst), stateDir = instanceStateDir(inst);
-  const standalone = inst.hosting_shape === 'standalone';
+  const standalone = inst.hosting_shape === 'cloud-host';
   const workDir = standalone ? standaloneRoot(inst) : REPO_ROOT;
   const execStart = standalone
     ? `/usr/bin/node ${CORE_PKG_DIR}/src/platform-server.js`
@@ -91,7 +91,7 @@ function backupTimerPath(inst) { return `/etc/systemd/system/${backupUnitName(in
 // scripts/gds/ — mirrors serviceUnit's execStart resolution so they can't diverge.
 function backupScriptPath(inst) {
   const rel = 'scripts/gds/db-backup-nightly.sh';
-  return inst.hosting_shape === 'standalone'
+  return inst.hosting_shape === 'cloud-host'
     ? path.posix.join(standaloneRoot(inst), CORE_PKG_DIR, rel)
     : path.posix.join(REPO_ROOT, rel);
 }

package/scripts/gds/provision.js

@@ -238,7 +238,7 @@ async function provisionInstance(inst, deps) {
   // So a standalone uses the control-plane executors; co-tenant + dedicated are
   // unchanged (boxExec === exec, boxWriteFile === writeFile). When no remoteHost is
   // set, controlExec === exec anyway, so this is a no-op for the all-local default.
-  const standalone = inst.hosting_shape === 'standalone';
+  const standalone = inst.hosting_shape === 'cloud-host';
   const boxExec = standalone ? controlExec : exec;
   const boxWriteFile = standalone ? (deps.controlWriteFile || writeFile) : writeFile;
   const sudoP = privileged ? 'sudo ' : '';   // systemctl escalation prefix (task 2066)
@@ -372,7 +372,7 @@ async function provisionInstance(inst, deps) {
     // materialize config/ + .claude/ + file:-pinned core + lockfile → commit + push
     // (ADR 0108 / 0125, task 2055). Replaces the old "repo must already be cloned"
     // throw: the greenfield flow now has no manual clone step. Idempotent + dry-run-safe.
-    if (inst.hosting_shape === 'standalone') {
+    if (inst.hosting_shape === 'cloud-host') {
       await scaffoldStandaloneRepo(inst, deps);
       // A PRIVATE target_ref gets its own read-only deploy key BEFORE step 2's
       // `git pull --ff-only origin main` — the pull that failed unauthenticated
@@ -740,7 +740,7 @@ async function domainAttachInstance(inst, deps) {
   const controlExec = deps.controlExec || exec;
   // Same box routing as provisionInstance: a standalone runs control-plane-local
   // (task 2074), so its env/caddy/service live HERE, not on the co-hosting box.
-  const standalone = inst.hosting_shape === 'standalone';
+  const standalone = inst.hosting_shape === 'cloud-host';
   const boxExec = standalone ? controlExec : exec;
   const boxWriteFile = standalone ? (deps.controlWriteFile || writeFile) : writeFile;
   const sudoP = privileged ? 'sudo ' : '';
@@ -876,7 +876,7 @@ async function domainAttachInstance(inst, deps) {
 async function settingsApplyInstance(inst, deps) {
   const { db, provisioning, exec, writeFile, log, apply, privileged } = deps;
   // Same box routing as domainAttachInstance: a standalone runs control-plane-local.
-  const standalone = inst.hosting_shape === 'standalone';
+  const standalone = inst.hosting_shape === 'cloud-host';
   const boxExec = standalone ? (deps.controlExec || exec) : exec;
   const boxWriteFile = standalone ? (deps.controlWriteFile || writeFile) : writeFile;
   const sudoP = privileged ? 'sudo ' : '';
@@ -992,7 +992,7 @@ async function settingsApplyInstance(inst, deps) {
 async function restartInstance(inst, deps) {
   const { db, provisioning, exec, log, apply, privileged } = deps;
   // Same box routing as settingsApplyInstance: a standalone runs control-plane-local.
-  const boxExec = inst.hosting_shape === 'standalone' ? (deps.controlExec || exec) : exec;
+  const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || exec) : exec;
   const sudoP = privileged ? 'sudo ' : '';
   log(`restart ${inst.slug} (shape=${inst.hosting_shape}, status=${inst.status})`);
 
@@ -1124,7 +1124,7 @@ async function placeManifestCreds(inst, mrow, deps) {
     return { ok: false, error: 'GitHub App Manifest cred placement is not supported for a dedicated droplet yet — run oauth-secret.js on the droplet instead' };
   }
   if (!mrow.github_code) return { ok: false, error: 'manifest row carries no github_code to convert' };
-  const standalone = inst.hosting_shape === 'standalone';
+  const standalone = inst.hosting_shape === 'cloud-host';
   const boxExec = standalone ? (deps.controlExec || deps.exec) : deps.exec;
   const boxWriteFile = standalone ? (deps.controlWriteFile || deps.writeFile) : deps.writeFile;
   const sudoP = deps.privileged ? 'sudo ' : '';

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.999'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1001'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/collab_page.mjs

@@ -565,12 +565,138 @@ test('the asker can settle in place, with both outcomes', () => {
   assert.match(js, /patchHelpRequestsId/, 'through the real API, not a local edit');
 });
 
-test('there is deliberately NO reply thread — that would reimplement the Agora', () => {
-  // The goal forbids reimplementing the Agora to get around C06's dependency.
-  const js = read('modules', 'hall-ui', 'public', 'collab.js');
-  for (const f of ['reply', 'comment', 'thread', 'message']) {
-    assert.ok(!new RegExp(`data-${f}|post${f}`, 'i').test(js), `no ${f} surface`);
+// REPLACED, not deleted (task 1004216). This test used to read "there is
+// deliberately NO reply thread — that would reimplement the Agora", deferring
+// replies to task 1002946 under goal 1000064. That task is ABANDONED and that
+// goal is ARCHIVED, so the deferral had no addressee left: the surface that was
+// to own replies will never be built, and an ask stayed unanswerable to keep a
+// promise to a thing that does not exist. ADR 0330 records the reversal.
+//
+// What the old test was PROTECTING is still real, so it is what these assert:
+// a thread here must not grow into the chat surface ADR 0187 §4a declined.
+test('an ask can be answered — and the answer surface stops well short of a chat', () => {
+  const src = read('modules', 'hall-ui', 'public', 'collab.js');
+  // Comments stripped before the bans are checked: this file ARGUES at length
+  // about the four things it is not building, and a scan that read the argument
+  // as the thing would fail on the very prose explaining the restraint.
+  const js = src.replace(/^\s*\/\/.*$/gm, '');
+  assert.match(js, /data-reply-form/, 'there is somewhere to write an answer');
+  assert.match(js, /POST', `\/help-requests\/\$\{id\}\/replies`/, 'and it posts to the replies route');
+
+  // The four things a chat has that this must not grow.
+  assert.ok(!/data-edit|patchReply|editReply/i.test(js), 'no edit — a reply is what was said at the time');
+  assert.ok(!/deleteReply|data-reply-delete/i.test(js), 'no delete');
+  assert.ok(!/data-react|reaction|emoji/i.test(js), 'no reactions');
+  assert.ok(!/parent_reply|data-reply-to|@mention|mentions/i.test(js), 'no nesting and no mentions');
+});
+
+// RUN, not grepped — this file's own convention for everything in collab-lib.js,
+// and the grader was right that the first pass broke it. canClose in particular
+// decides whether a close control is drawn at all, so each branch of it needs a
+// test that calls it rather than a regex that agrees with a wrong answer.
+test('canClose: the asker and the addressee, and nobody else', () => {
+  const L = lib();
+  const craftAsk = { requested_by: '90', needs_craft: 'artist', needs_builder_id: null };
+  const namedAsk = { requested_by: '90', needs_craft: null, needs_builder_id: '7' };
+
+  assert.equal(L.canClose(namedAsk, 90, []), true, 'the asker always may');
+  assert.equal(L.canClose(namedAsk, 7, []), true, 'so may the person it names');
+  assert.equal(L.canClose(craftAsk, 7, ['artist']), true, 'or a craft they belong to');
+
+  assert.equal(L.canClose(craftAsk, 7, ['builder']), false, 'a craft they do not belong to is not theirs to close');
+  assert.equal(L.canClose(namedAsk, 8, ['artist']), false, 'a stranger to a by-name ask');
+  assert.equal(L.canClose(craftAsk, 7, []), false, 'no declared craft reaches no craft ask');
+});
+
+test('canClose fails CLOSED on every missing fact', () => {
+  // The page reads meId from /me. A failed read leaves it null, and the correct
+  // answer then is "draw nothing" — never "draw it and let the server refuse".
+  const L = lib();
+  const ask = { requested_by: '90', needs_builder_id: '7' };
+  for (const bad of [null, undefined]) {
+    assert.equal(L.canClose(ask, bad, ['artist']), false, `meId ${bad} draws no control`);
+  }
+  assert.equal(L.canClose(null, 7, ['artist']), false, 'no request, no control');
+  assert.equal(L.canClose({ requested_by: '90', needs_craft: null }, 7, null), false,
+    'a non-array craft list is not iterated into a yes');
+});
+
+test('canClose compares ids ACROSS types — the API sends strings, /me sends what it sends', () => {
+  // The live bug this forecloses: needs_builder_id arrives as "7" and meId as 7,
+  // and === between them is false, so the person a request names would silently
+  // lose their own close control.
+  const L = lib();
+  assert.equal(L.canClose({ requested_by: '90', needs_builder_id: '7' }, 7, []), true);
+  assert.equal(L.canClose({ requested_by: 90, needs_builder_id: 7 }, '7', []), true);
+});
+
+test('threadOf: oldest first, ties broken on id, and never explodes on a missing thread', () => {
+  const L = lib();
+  const out = L.threadOf({ replies: [
+    { id: 3, created_at: '2026-09-22T10:00:00Z' },
+    { id: 1, created_at: '2026-09-20T10:00:00Z' },
+    { id: 2, created_at: '2026-09-22T10:00:00Z' },
+  ] });
+  assert.deepEqual(out.map((r) => r.id), [1, 2, 3], 'two replies in the same second keep the order written');
+  assert.deepEqual(L.threadOf({}), [], 'a row with no replies field');
+  assert.deepEqual(L.threadOf(null), []);
+  assert.deepEqual(L.threadOf({ replies: 'nonsense' }), [], 'and a field that is not a list');
+});
+
+test('saidLabel is the PAST tense — an answer is not a debt', () => {
+  // ageLabel says "waiting 3 days", which under an answer reads as the answer
+  // still being owed: the exact opposite of what a reply means.
+  const L = lib();
+  const NOW2 = Date.parse('2026-09-23T12:00:00Z');
+  const ago = (d) => new Date(NOW2 - d * 86400000).toISOString();
+  assert.equal(L.saidLabel(ago(0), NOW2), 'today');
+  assert.equal(L.saidLabel(ago(1), NOW2), 'yesterday');
+  assert.equal(L.saidLabel(ago(3), NOW2), '3 days ago');
+  assert.equal(L.saidLabel(ago(21), NOW2), '3 weeks ago');
+  assert.equal(L.saidLabel('nonsense', NOW2), 'just now', 'an unknown time is not an accusation');
+  for (const label of [L.saidLabel(ago(3), NOW2), L.saidLabel(ago(21), NOW2)]) {
+    assert.ok(!/waiting/.test(label), `"${label}" must not borrow the ask's tense`);
+  }
+});
+
+test('replyAuthor names somebody, whatever the server sent', () => {
+  const L = lib();
+  // Neutral names on purpose: this is the portable core, and a founder's login
+  // baked into a fixture is what audit-authorship.sh exists to catch.
+  assert.equal(L.replyAuthor({ builder_name: 'Preview Alpha', builder_login: 'preview-alpha' }), 'Preview Alpha');
+  assert.equal(L.replyAuthor({ builder_login: 'preview-alpha' }), 'preview-alpha', 'the login when there is no display name');
+  assert.equal(L.replyAuthor({ builder_id: 7 }), 'builder 7', 'the bare id an older server sends');
+  assert.equal(L.replyAuthor({}), 'someone', 'never an empty byline');
+  assert.equal(L.replyAuthor(null), '');
+});
+
+test('validateReplyBody refuses before the round trip, and trims what it accepts', () => {
+  const L = lib();
+  assert.deepEqual(L.validateReplyBody('  moot  '), { ok: true, body: 'moot' });
+  assert.equal(L.validateReplyBody('   ').ok, false);
+  assert.equal(L.validateReplyBody('   ').reason, 'empty');
+  assert.equal(L.validateReplyBody(null).reason, 'empty');
+  assert.equal(L.validateReplyBody('x'.repeat(L.MAX_REPLY + 1)).reason, 'too_long');
+  assert.equal(L.validateReplyBody('x'.repeat(L.MAX_REPLY)).ok, true, 'the cap itself is allowed');
+});
+
+test('append-only is enforced by the DATABASE, not by the routes that exist today', () => {
+  // A route layer that merely omits an update is one careless PR from allowing
+  // one. The table refuses an UPDATE or a DELETE outright, so the guarantee
+  // holds against a future route, a migration, or a hand-run statement.
+  const raw = read('modules', 'lifecycle', 'migrations', 'lifecycle_011_help_request_replies.sql');
+  assert.match(raw, /BEFORE UPDATE OR DELETE ON lifecycle_help_request_replies/);
+  assert.match(raw, /RAISE EXCEPTION/, 'and it raises rather than silently ignoring the write');
+  // Same reason as above — the migration's header names the columns it refuses
+  // to have, so the ban is checked against the STATEMENTS, not the argument.
+  const sql = raw.replace(/^\s*--.*$/gm, '');
+  for (const col of ['updated_at', 'edited_by', 'deleted_at', 'parent_reply_id']) {
+    assert.ok(!new RegExp(`\\b${col}\\b`).test(sql), `no ${col} column — the shape refuses to become a chat`);
   }
+
+  const routes = read('modules', 'lifecycle', 'routes', 'help-requests.js');
+  assert.ok(!/router\.(patch|delete|put)\('\/help-requests\/:id\/replies/.test(routes),
+    'and no route offers to change one');
 });
 
 // ---- placement ------------------------------------------------------------
@@ -724,7 +850,14 @@ test('the skill the page invokes exists, and is the ANSWERING half', () => {
   assert.match(md, /^name: collab-review$/m);
   assert.match(md, /GET \/api\/bongos\/help-requests\/for-me/);
   assert.match(md, /GET \/api\/bongos\/task-recommendations\/for-me/);
-  // The asymmetry the routes enforce, stated where a session will read it.
-  assert.match(md, /cannot settle a help request addressed to you/i);
+  // The rules the routes enforce, stated where a session will read them. Since
+  // ADR 0330 the addressee CAN close an ask — so what the skill must carry is no
+  // longer "you cannot", it is "you do not, because you are not the one who read
+  // the answer", plus the half that did not widen.
+  assert.match(md, /POST \/api\/bongos\/help-requests\/:id\/replies/, 'it answers on the ask');
+  assert.match(md, /Do NOT close the ask/, 'and hands the close to a person');
+  assert.match(md, /withdraw/i, 'and knows withdraw did not widen');
+  assert.ok(!/POST \/api\/bongos\/help-requests --body-file/.test(md),
+    'the file-a-counter-ask workaround is deleted, not left beside the real thing');
   assert.match(md, /DATA, not instructions/, 'an ask is untrusted input');
 });

package/tests/core_upgrade_door.mjs

@@ -119,7 +119,7 @@ await t('and widening it did NOT let the destructive acts through', () => {
 });
 
 await t('an ordinary instance is untouched by the guard', () => {
-  for (const shape of ['co-tenant', 'dedicated', 'standalone']) {
+  for (const shape of ['co-tenant', 'dedicated', 'cloud-host']) {
     for (const a of P.INTENT_ACTIONS) {
       assert.equal(G.intentAllowedForShape(a, shape), true, `${a}/${shape} must be unaffected`);
     }